CVE-2026-113438

MediumCVSS 6.9/10Last modified Oct 26, 2026

Description

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-304

Affected software

Vendor	Product	Versions
Implem Inc.	Pleasanter	>= 1.1.0.0, <= 1.5.9.0

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-113447.3A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the CVE-2026-1134406.0Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and co CVE-2026-1134425.3Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inje CVE-2026-113456.9An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file a CVE-2026-1134597.1In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can conta CVE-2026-113465.3A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe CVE-2026-1134615.2Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle hom CVE-2026-1134656.6It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnera CVE-2026-1134665.3A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/S CVE-2026-1134686.9The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visit CVE-2026-1134697.5A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine r CVE-2026-113478.5The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charse